PCI DSS requirement 3.5.3

3.5.3 Store secret and private keys used to encrypt/decrypt cardholder data in one (or more) of the following forms at all times: ............ As at least two full-length key components or key shares, in accordance with an industry accepted method

Could you let me what the full-length key components,what is relationship with secret and private keys store? AS a QSA how to Verify if the The audited party meet the condition? Thanks a lot~

3 Answers 3


Key components: Let's say you've a symmetric encryption key. To backup the key and achieve split knowledge, you export the key as separate components.

If the key is a 128-bit key, you should get key components which are each 128-bits in length. You can have two or more components. These components can be XOR'd together (a bitwise operation) to recreate the initial encryption key.

These key components should be under the responsibility of different individuals (i.e. key custodians).

With the above, you have split knowledge - no single individual knows the full key and knowledge of a single component provides no means to derive the original key.

You also have dual control - at least two individuals are required in order to recreate the encryption key.

The key store relates to where the key is located - e.g. the data encryption key is likely stored as a cryptogram encrypted with a key encryption key of equal or greater strength.

Verification is typically through review of a documented process, interviews with key custodians, review of logs of key generation and component storage locations.

  • Thanks for your infos AndyMac! Question: If the key is a 128-bit key,the Split knowledge of keys why not separate to two separate components like 80bit+48bit? why each need 128bit "PCI requirement"? Is that for XOR ? 128-bit orginal bit +128-bit random number?
    – Michael
    Commented Nov 30, 2018 at 5:14
  • Dual control of keys in PCI-DSS:such that "at least two people are required to perform any key-management operations and no one person has access to the authentication materials (for example, passwords or keys) of another, " What do you think of Dual Control in reality? I understand about dual control for authentication like A user has password,B has keys,then AB use one PC to login to access the source data , and then ? if AB need a new key generation,what will they do for Dual Control, if A do key generation action by himself and B monitor A operation,is it called Dual Control?
    – Michael
    Commented Nov 30, 2018 at 6:23
  • For dual control, you must not be able to perform a function without at least two people. Where B is monitoring A but A could do it alone, this may not be dual control unless A could be in the room without B providing access and being present. For a new key they could use PBKDF2 and each of A and B could enter half a password each where each half is only known to them and, for back up, each half is written on paper and stored in a sealed envelope in separate safes each of which is accessible by one individual.
    – AndyMac
    Commented Nov 30, 2018 at 13:03
  • Thanks for your further explain about dual control,i totally understand it. About "t least two full-length key components", Let's say initial encryption key.= "password" 8 letters, "at least two full-length key components " means we still need two full-length key with 8 letters A and B keys which A xor B ="password",correct? I'm still confusing how to verify the company meet the "Two full-length key components " requirement
    – Michael
    Commented Dec 2, 2018 at 10:39
  • To verify it, you can interview the personnel responsible for doing it, review the documentation which describes the process, review an example of the process (i.e. ask them to simulate it). There's not much else you can do!
    – AndyMac
    Commented Dec 4, 2018 at 15:55

IANAQSA but I believe this is referencing Split Keys.

NIST SP800-57 is likely the sort of acceptable standard the PCI SSC had in mind. To quote: Confidentiality

....If confidentiality protection is required, the keying material shall be protected using one or more of the following mechanisms:

  1. Manual method:



(b) The keying material is separated into key components, with each key component being generated at a security strength that meets or exceeds the security strength required of the keying material. Each key component is handled, using split knowledge procedures (see Sections and, so that no single individual can acquire access to all key components.

and Key Generation


When split-knowledge procedures are used, the key shall exist outside of a [FIPS140] cryptographic module as multiple key components. The keying material may be created within a cryptographic module and then split into components for export from the module, or may be created as separate components. Each key component shall provide no knowledge of the key value (e.g., each key component must appear to be generated randomly). If knowledge of k components is required to construct the original key, then knowledge of any k-1 key components shall provide no information about the original key other than, possibly, its length.

I have not seen split keys implemented, and have never had reason to discuss them with a QSA, so I cannot give you more practical guidance as to what sort of implementation would pass QSA muster. You may want to consider posting this question to Crypto.SE which is more focused to this level of detail.

  • I'm very appreciate your valuable informations @gowenfawr , i will go further investigation, Do you know any online chatting group about PCI-DSS? I‘m a new auditor in PCI DSS field,and i'm preparing for PCI-DSS exam now
    – Michael
    Commented Nov 29, 2018 at 6:51
  • @Michael I'm afraid I do not - I'm on the audited side of the equation, not the auditor side. Since you'd need to be part of a QSA firm to be certified as a QSA, hopefully there are coworkers you could reach out to with that question?
    – gowenfawr
    Commented Nov 29, 2018 at 15:55

Sounds like two keys used within a key sharing scheme. For instance, you could have two keys K0 and K1 which, when XOR'ed together form the protected key. Of course both keys need to be the same (full) length of the original key.

In that case you need both keys. There are also 2 out of 3 schemes etc., a so called threshold scheme such as Shamir's secret sharing.

Of course you could also split keys by cutting them into parts and share those. In that case the keys are smaller in size. This would also mean that it is easier to guess the remaining bits from just one key share. In other words, the keys need to be full size to maintain the same level of security as the key to protect. More information in the Wikipedia article.

  • "Consider for example the secret sharing scheme in which the secret phrase "password" is divided into the shares "pa––––––", "––ss––––", "––––wo––", and "––––––rd". Above example "pa-----" it is 2 letters ,but PCI DSS require at least two full-length key components ,it means it need two "password" key components correct? Or we need two 8 eight letter components A B which A xor B = "password" ?
    – Michael
    Commented Dec 2, 2018 at 10:28
  • So undoubtedly the latter is required. The other downgrade the security of the key; even if you just have "--ss----" then you have 25% less key space to search. Probably needless to say: a password is not a key - I presume that this is just an example. Commented Dec 2, 2018 at 16:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .